Sourcify Privacy Policy

Sourcify (“the App”) provides product sourcing from Chinese marketplaces (1688 and Taobao), import of sourced products into your store, and order fulfillment with shipment tracking (“the Service”) to merchants who use Shopify to power their stores. This Privacy Policy describes how personal information is collected, used, and shared when you install or use the App in connection with your Shopify-supported store.

The App is operated by SOURCIFY LIMITED (Unit 12, 9/F, The Cloud, 111 Tung Chau Street, Tai Kok Tsui, Hong Kong), which is responsible for the data relating to your account, your subscription, your use of the App and the orders you place through it.

Personal Information the App Collects

When you install the App, we are automatically able to access certain types of information from your Shopify account:

• Products (read_products, write_products): read your catalogue, and create or update the products, variants and images you import from the App.
• Inventory (write_inventory): set stock levels on the products the App manages.
• Orders (read_orders, write_orders): read the orders placed in your store that contain products sourced through the App, so that they can be prepared and shipped, and update them with their fulfillment status.
• Draft orders (write_draft_orders): create a draft order in your store for an order you enter manually in the App.
• Fulfillment orders and fulfillments (read_merchant_managed_fulfillment_orders, write_merchant_managed_fulfillment_orders, read_assigned_fulfillment_orders, write_assigned_fulfillment_orders, read_third_party_fulfillment_orders, write_third_party_fulfillment_orders, write_fulfillments): register the App as a fulfillment service for the products it ships, accept the fulfillment requests assigned to it, and post shipments and tracking numbers back to your store.

The App also receives notifications (webhooks) from Shopify about your orders (created, updated, paid, cancelled, fulfilled), your products (created, updated, deleted), refunds, the App's subscription billing, the App's lifecycle (uninstallation, changes to the permissions granted), and Shopify's mandatory privacy requests (customers/data_request, customers/redact, shop/redact).

Additionally, we collect the following types of personal information from you and/or your customers once you have installed the App:

• Information about you and others who may access the App on behalf of your store: email address, first and last name, and the technical identifier issued by our authentication provider; your billing identity (entity type, legal name, registration number, tax number, postal address, telephone, billing email); an optional business profile completed at sign-up (experience level, monthly sales volume, main objective, product sector, how you heard about us); your subscription and billing data (plan, status, due dates, invoices, transaction identifiers at our payment provider; we neither receive nor store your card numbers); your store's domain, identifiers and the access tokens issued by Shopify; your usage of the App (last sign-in, interface language, active store, searches and sourcing requests, orders, email preferences); your support messages and attachments; your referral programme data (personal code, linked referees, rewards, and, if you request a payout, the account holder's name and IBAN, encrypted at rest); the documents and versions of our terms you accepted, with the date, browser and country at the time of acceptance; and the two-letter country code derived from your IP address at sign-up and sign-in. The IP address itself is not stored in our database.
• Information about your customers: for each order to be fulfilled, the recipient's name, delivery address, and the email address and telephone number where needed for shipping or customs clearance; the contents of the order; and its delivery tracking. We receive no payment data about your customers: payment for your sales takes place entirely within Shopify. For this data we act as your processor, on your instructions, under our Data Processing Agreement.
• Information about individuals who visit your store: none. The App adds no script, pixel or cookie to your storefront and does not collect your visitors' IP address, browser details, time zone or cookies.

We collect personal information directly from the relevant individual, through your Shopify account, or using the following technologies. “Cookies” and similar browser storage are data files placed on your device; the App uses only those strictly necessary for it to work (keeping your session open, remembering your language and a few display preferences, caching the application for faster loading, and an anti-abuse attestation token), and no advertising or analytics cookie. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org. “Log files” track actions occurring on the App, and collect data including your browser type, referring/exit pages, and date/time stamps; the IP address is used to derive a country code and is not retained in our database. We do not use web beacons, tags or pixels.

How Do We Use Your Personal Information?

We use the personal information we collect from you and your customers in order to provide the Service and to operate the App: source the products you select, place the corresponding orders with our fulfillment provider, ship them to your customers, synchronise fulfillment status and tracking with your store, and bill your subscription. Additionally, we use this personal information to:

• communicate with you: service emails about your orders, sourcing requests, billing and security, and replies to your support requests;
• optimise or improve the App, measure how it is used and fix incidents;
• provide you with information relating to our products or services: follow-up and product-news emails, each of which can be stopped with a one-click opt-out;
• secure the App and detect abuse and fraud;
• run the referral programme and pay its rewards;
• keep evidence that our terms were accepted; and
• comply with our accounting, tax and legal obligations.

We do not use your personal information, or your customers', for behavioural or targeted advertising.

Sharing Your Personal Information

We share your Personal Information with the following providers, which act on our instructions to help us provide the Service:

• Our sourcing and fulfillment partner (United Kingdom and China): sourcing, procurement, preparation, shipping and tracking of the goods. It receives the order contents, the recipient's name and address, and the contact details needed for transport and customs clearance, and nothing more. The carriers it engages for final delivery receive the delivery address.
• Shopify (Ireland and Canada): your own provider, which we connect to with your authorisation to synchronise products, orders and shipments, and which bills the App's subscription when you take it out from your Shopify admin.
• Railway Corp.: hosting of the App's API and main database, in the European Union (Netherlands).
• Google (Firebase Authentication, App Check, Cloud Storage): account authentication, anti-abuse protection and storage of PDF invoices (European Union and United States).
• Sentry (Functional Software, Inc.): server error monitoring (European Union and United States).
• Resend: delivery of service and follow-up emails (United States).
• InflowPay: collection of subscriptions and goods orders. Card data is handled by its PCI DSS certified partners and never passes through our systems.
• French public administration (Base Adresse Nationale, Annuaire des Entreprises): verification and completion of the addresses and registration numbers you declare.

The up-to-date list, with each provider's role and location, is published on our Sub-processors page. We do not sell your data and do not rent it to anyone.

Finally, we may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.

Behavioural Advertising

We do not use your Personal Information to provide you with targeted advertisements, and we share no data with advertising networks or social-network pixels. There is therefore nothing to opt out of.

Your Rights

If you are a European resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. You may also ask us to restrict a processing, to receive the data you provided in a structured format, and object to processing based on our legitimate interests, and at any time to direct marketing. If you would like to exercise these rights, please contact us through the contact information below. We reply within one month, extendable by two months for complex requests.

Additionally, if you are a European resident we note that we are processing your information in order to fulfill contracts we might have with you (for example when you subscribe to the App or place an order through it), or otherwise to pursue our legitimate business interests listed above. Additionally, please note that your information will be transferred outside of Europe, including to Hong Kong (administration of the App by SOURCIFY LIMITED), the United Kingdom and China (sourcing and fulfillment, limited to the data needed for shipping) and the United States (authentication, email delivery and technical monitoring).

These transfers rely on the European Commission's standard contractual clauses, with a transfer impact assessment, on the adequacy decision for the United Kingdom, and, for providers in the United States, on the EU-U.S. Data Privacy Framework or standard contractual clauses. A copy of the safeguards in place, and the contact details of our representative in the European Union, can be obtained on request at the address below. You may also lodge a complaint with your supervisory authority (in France, the CNIL; in the United Kingdom, the ICO; in Hong Kong, the PCPD).

Requests concerning your customers' data are handled through Shopify's mandatory privacy webhooks, in accordance with Shopify's requirements for apps. When a customer asks you for their data (customers/data_request), we provide you with the personal information we hold about that customer so that you can answer them. When a customer asks you to delete their data (customers/redact), we erase or irreversibly anonymise the personal information attached to that customer's orders, subject only to the retention that accounting law requires. When you uninstall the App (shop/redact), the customer data attached to your store's orders (names, addresses, contact details) is anonymised and your store's access tokens are deleted; the orders themselves are kept, anonymised, for accounting purposes. You may also send us such a request directly, in your capacity as controller, and we assist you in answering it.

Data Retention

When an order is placed through the App, we will maintain your Order Information for our records for 5 years from delivery, as contractual evidence, unless and until you ask us to delete this information. Other data is kept as follows:

Data	Period
Account and profile	Life of the account, then 3 years after the last activity
Invoices and accounting records	10 years, in accordance with accounting and tax obligations
Orders, shipments and tracking	5 years from delivery
Your customers' data	On your instructions, and at most 5 years after the order
Support conversations	3 years after the case is closed
Referral bank details	13 months after payout, then deleted
Evidence of acceptance of the terms	5 years after the end of the contractual relationship
Technical and security logs	12 months
Store access tokens	Deleted when the store is disconnected or the App uninstalled

At the end of the period, data is deleted or irreversibly anonymised. Some data may be kept longer where a dispute or a legal obligation requires it, and solely for that purpose.

Changes

We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons. The applicable version is the one published here, identified by its date.

Contact Us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at contact@sourcifyapp.com or by mail using the details provided below:

SOURCIFY LIMITED
Unit 12, 9/F, The Cloud, 111 Tung Chau Street
Tai Kok Tsui, Hong Kong

For any other question, write to contact@sourcifyapp.com or use the Support section of the App.